CVE-2023-22815
Post-authentication remote command injection vulnerability on Western Digital My Cloud OS 5 devices
Severity Score
6.7
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context of the root user on vulnerable CGI files. This vulnerability can only be exploited over the network and the attacker must already have admin/root privileges to carry out the exploit. An authentication bypass is required for this exploit, thereby making it more complex. The attack may not require user interaction. Since an attacker must already be authenticated, the confidentiality impact is low while the integrity and availability impact is high.
This issue affects My Cloud OS 5 devices: before 5.26.300.
*Credits:
Nikita Abramov (Positive Technologies)
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-01-06 CVE Reserved
- 2023-06-30 CVE Published
- 2024-09-05 CVE Updated
- 2024-09-06 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Westerndigital Search vendor "Westerndigital" | My Cloud Os Search vendor "Westerndigital" for product "My Cloud Os" | < 5.26.300 Search vendor "Westerndigital" for product "My Cloud Os" and version " < 5.26.300" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Search vendor "Westerndigital" for product "My Cloud" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Os Search vendor "Westerndigital" for product "My Cloud Os" | < 5.26.300 Search vendor "Westerndigital" for product "My Cloud Os" and version " < 5.26.300" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Dl2100 Search vendor "Westerndigital" for product "My Cloud Dl2100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Os Search vendor "Westerndigital" for product "My Cloud Os" | < 5.26.300 Search vendor "Westerndigital" for product "My Cloud Os" and version " < 5.26.300" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Dl4100 Search vendor "Westerndigital" for product "My Cloud Dl4100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Os Search vendor "Westerndigital" for product "My Cloud Os" | < 5.26.300 Search vendor "Westerndigital" for product "My Cloud Os" and version " < 5.26.300" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Ex2 Ultra Search vendor "Westerndigital" for product "My Cloud Ex2 Ultra" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Os Search vendor "Westerndigital" for product "My Cloud Os" | < 5.26.300 Search vendor "Westerndigital" for product "My Cloud Os" and version " < 5.26.300" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Ex2100 Search vendor "Westerndigital" for product "My Cloud Ex2100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Os Search vendor "Westerndigital" for product "My Cloud Os" | < 5.26.300 Search vendor "Westerndigital" for product "My Cloud Os" and version " < 5.26.300" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Ex4100 Search vendor "Westerndigital" for product "My Cloud Ex4100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Os Search vendor "Westerndigital" for product "My Cloud Os" | < 5.26.300 Search vendor "Westerndigital" for product "My Cloud Os" and version " < 5.26.300" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Mirror G2 Search vendor "Westerndigital" for product "My Cloud Mirror G2" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Os Search vendor "Westerndigital" for product "My Cloud Os" | < 5.26.300 Search vendor "Westerndigital" for product "My Cloud Os" and version " < 5.26.300" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Pr2100 Search vendor "Westerndigital" for product "My Cloud Pr2100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Os Search vendor "Westerndigital" for product "My Cloud Os" | < 5.26.300 Search vendor "Westerndigital" for product "My Cloud Os" and version " < 5.26.300" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Pr4100 Search vendor "Westerndigital" for product "My Cloud Pr4100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Os Search vendor "Westerndigital" for product "My Cloud Os" | < 5.26.300 Search vendor "Westerndigital" for product "My Cloud Os" and version " < 5.26.300" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | Wd Cloud Search vendor "Westerndigital" for product "Wd Cloud" | - | - |
Safe
|